CVE-2023-38267: Missing Encryption of Sensitive Data

IBM Security Access Manager Appliance IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1 could allow a local user to possibly elevate their privileges due to sensitive configuration information being exposed. IBM X-Force ID: 260584...

IBM Security Access Manager Appliance Access Control Error Vulnerability (CNVD-2022-87650)

The IBM Security Access Manager Appliance ISAM Appliance is a network appliance-based security solution from IBM of the United States. The product is primarily used for access control and Web-based threat protection, providing system performance monitoring, log analysis, and diagnostics.IBM...

Code injection

IBM Security Access Manager Appliance 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 225081...

CVE-2022-22465: Undefined Security Weakness

IBM Security Access Manager Appliance 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 could allow a local user to obtain elevated privileges due to improper access permissions. IBM X-Force ID: 225082...

CVE-2022-22463: Improper Neutralization of Special Elements used in an SQL Command

IBM Security Access Manager Appliance 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 22507...

CVE-2022-22464: Inadequate Encryption Strength

IBM Security Access Manager Appliance 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 225081...

Security Bulletin: IBM Security Access Manager has fixed a vulnerability in the log4j library shipped with the product. (CVE-2021-4104)

Summary The IBM Security Access Manager version 9.0 ships with a version of log4j that is vulnerable to CVE-2021-4104. The log4j library is no longer used by the IBM Security Access Manager product and a Fixpack has been provided to remove the unused library. Vulnerability Details CVEID:...

Micro Focus Access Manager Appliance 信息泄露漏洞

Micro Focus Access Manager Appliance is an application from Micro Focus UK. It is used to improve security and simplify management. An information disclosure vulnerability exists in Micro Focus Access Manager product, which can be exploited by attackers to expose information and disclose advanced...

Micro Focus Access Manager Appliance 跨站脚本漏洞

Micro Focus Access Manager Appliance is an application from Micro Focus UK. It is used to improve security and simplify management. A cross-site scripting vulnerability exists in Micro Focus Access Manager product. An attacker could exploit the vulnerability to cause configuration corruption...

Security Bulletin: Security Vulnerabilities in IBM WebSphere Liberty fixed in IBM Security Access Manager Appliance

Summary A Security Vulnerability in IBM WebSphere Liberty has been fixed in the IBM Security Access Manager Appliance Vulnerability Details CVEID: CVE-2019-4441 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain sensitive...

CVE-2020-4395: Insufficient Session Expiration

IBM Security Access Manager Appliance 9.0.7 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 179358...

CVE-2019-4725: Improper Neutralization of Input During Web Page Generation

IBM Security Access Manager Appliance 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 172131...

CVE-2020-4461: Undefined Security Weakness

IBM Security Access Manager Appliance 9.0.7.1 could allow an authenticated user to bypass security by allowing idtoken claims manipulation without verification. IBM X-Force ID: 181481...

CVE-2019-4707: Improper Restriction of XML External Entity Reference

IBM Security Access Manager Appliance 9.0.7.0 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 172018...

CVE-2019-4036: Undefined Security Weakness

IBM Security Access Manager Appliance could allow unauthenticated attacker to cause a denial of service in the reverse proxy component. IBM X-Force ID: 156159...

Security Bulletin: Multiple Security Vulnerabilities fixed in IBM Security Access Manager Appliance

Summary Multiple Security vulnerabilities have been fixed in the 9.0.7 IBM Security Access Manager ISAM appliance. Vulnerability Details CVEID: CVE-2018-0732 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the sending of a very large prime value to the client by a malicious...

Security Bulletin: Multiple Security vulnerabilities have been fixed in the IBM Security Access Manager Appliance

Summary IBM Security Access Manager Appliance has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2018-10915 DESCRIPTION: PostgreSQL could allow a remote attacker to bypass security restrictions, caused by an issue with improperly resting internal state in between...

CVE-2018-1804: Session Fixation

IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 149703...

CVE-2018-1887: Use of Hard-coded Credentials

IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM...

CVE-2018-1813: Undefined Security Weakness

IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 150017...